CVE-2021-4459

SMA: Directory Traversal in Sunny Boy <3.10.27.R

Medium6.5EPSS 0.67%

Published: 27 Aug 2025
Updated: 27 Aug 2025
Reserved: 18 Jul 2025
Assigned by: CERTVDE

Description

An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected Sunny Boy devices.

Scores

CVSS scores of CVE-2021-4459, by who scored it
Scored by	CVSS	Score	Vector
CERTVDECNA (assigner)	3.1	Medium6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Deferred	3.1	Medium6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS (exploitation in 30 days): 0.67% · top 48% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

CWE-23 Relative Path Traversal (opens in a new tab)All about CWE-23 and its CVEs

Affected products

SMA · Boy 3.0
- affected 0.0.0 – < 3.10.27.R
SMA · Boy 3.6
- affected 0.0.0 – < 3.10.27.R
SMA · Boy 4.0
- affected 0.0.0 – < 3.10.27.R
SMA · Boy 5.0
- affected 0.0.0 – < 3.10.27.R
SMA · Boy 6.0
- affected 0.0.0 – < 3.10.27.R

References (1)

https://certvde.com/en/advisories/VDE-2025-066 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2021-4459](https://trackcve.app/badge/CVE-2021-4459.svg)](https://trackcve.app/cve/CVE-2021-4459)

Record last updated 27 Aug 2025, 16:18 UTC.